Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
37-9
Cisco AsyncOS 8.5.5 for Email Security User Guide
Chapter 37 Logging
Log Types
Interpreting a Text Mail Log
Use the following sample as a guide to interpret log files.
Note
Individual lines in log files are NOT numbered. They are numbered here only for sample purposes.
Use
as a guide to reading the preceding log file.
RCID
RPC Connection ID. This is a numerical identifier for an individual RPC
connection to the Spam quarantine. It is used to track messages as they are sent
to and from the Spam Quarantine.
connection to the Spam quarantine. It is used to track messages as they are sent
to and from the Spam Quarantine.
MID
Message ID: Use this to track messages as they flow through the logs.
RID
Recipient ID: Each message recipient is assigned an ID.
New
New connection initiated.
Start
New message started.
Table 37-4
Text Mail Log Statistics (continued)
Statistic
Description
Table 37-5
Text Mail Log Detail
1
Mon Apr 17 19:56:22 2003 Info: New SMTP ICID 5 interface Management (10.1.1.1)
address 10.1.1.209 reverse dns host remotehost.com verified yes
2
Mon Apr 17 19:57:20 2003 Info: Start MID 6 ICID 5
3
Mon Apr 17 19:57:20 2003 Info: MID 6 ICID 5 From: <sender@remotehost.com>
4
Mon Apr 17 19:58:06 2003 Info: MID 6 ICID 5 RID 0 To: <mary@yourdomain.com>
5
Mon Apr 17 19:59:52 2003 Info: MID 6 ready 100 bytes from <sender@remotehost.com>
6
Mon Apr 17 19:59:59 2003 Info: ICID 5 close
7
Mon Mar 31 20:10:58 2003 Info: New SMTP DCID 8 interface 192.168.42.42 address
10.5.3.25
8
Mon Mar 31 20:10:58 2003 Info: Delivery start DCID 8 MID 6 to RID [0]
9
Mon Mar 31 20:10:58 2003 Info: Message done DCID 8 MID 6 to RID [0]
10
Mon Mar 31 20:11:03 2003 Info: DCID 8 close
Table 37-6
Detail of Text Mail Log Example
Line Number
Description
1.
A new connection is initiated into the system and assigned an Injection ID (ICID)
of “5.” The connection was received on the Management IP interface and was
initiated from the remote host at 10.1.1.209.
of “5.” The connection was received on the Management IP interface and was
initiated from the remote host at 10.1.1.209.
2.
The message was assigned a Message ID (MID) of “6” after the
MAIL FROM
command is issued from the client.
3.
The sender address is identified and accepted.
4.
The recipient is identified and assigned a Recipient ID (RID) of “0.”
5.
MID 5 is accepted, written to disk, and acknowledged.